Given a "third party" lost my PCI data, and caused a cascade of events and expenses for others, that there had to be an equitable way to pass through the cost and expenses to the party responsible for the events.